CyberRota Analysis
AI-GeneratedThe vulnerability affects the Loofah library versions 2.25.0 to 2.25.2, specifically in the `allowed_uri?` method, which fails to properly reject certain malformed `javascript:` URIs that are prefixed with HTML5 whitespace character references. This oversight can lead to potential execution of malicious JavaScript when HTML-encoded strings are passed directly to the method, posing a risk to applications that rely on this functionality for sanitizing user input. Developers using affected versions of Loofah should prioritize updating to version 2.25.2 to mitigate this security risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. From 2.25.0 until 2.25.2, Loofah::HTML5::Scrub.allowed_uri? does not reject javascript: URIs whose scheme is split or prefixed with the HTML5 named whitespace character references 	 or 
. CGI.unescapeHTML leaves those references intact, so allowed_uri? reports the URL safe even though a browser decodes and strips the tab or line feed and executes the resulting javascript: URL. This issue affects only callers that pass HTML-encoded strings directly to allowed_uri?; Loofah's default sanitize() path is not affected. This issue is fixed in version 2.25.2.